Invisible Adversaries: New Attack Exposes Hidden Vulnerabilities in Particle Physics Machine Learning

Deep learning has quietly become one of the most powerful instruments in high energy physics. Neural networks now help simulate detector responses, reconstruct particle collisions, select candidate events, and trigger in real time at the Large Hadron Collider. Yet a team of German physicists and computer scientists argues that the validation procedures used to certify these models are dangerously incomplete. In a study published in The European Physical Journal C, researchers from the University of Bonn, the Bonn-Aachen Institute of Technology, and RWTH Aachen University introduce CONSERVAttack, an adversarial attack engineered to fool machine learning models while remaining statistically invisible to every standard check that physicists routinely apply to compare simulation with real data.

The problem the team targets is subtle but fundamental. High energy physics has long relied on a rigorous regime of systematic uncertainty evaluation, in which hundreds of separate studies probe physically motivated sources of discrepancy between simulated and observed data. Analyses cross-check marginal distributions of input features and their linear pairwise correlations in carefully designed control and validation regions, a discipline famously vindicated in the discovery of the Higgs boson. But neural networks exploit high-dimensional, non-linear correlations that these checks never probe. As soon as one allows hypothetical sources of mismodelling that are forgotten, overlooked, or entirely unknown, and acknowledges that the signal region where a classifier is ultimately applied may suffer from different discrepancies than the control regions, the traditional validation procedure may no longer provide appropriate coverage.

CONSERVAttack, whose name reflects its goal of conserving input distributions and correlations, flips the usual logic of adversarial attacks. Most attacks constrain perturbations on a per-event basis, for example by minimizing the L-infinity norm of each modified input. The new method instead constrains changes at the dataset level, ensuring that neither the marginal distributions of input features nor the correlations between them are significantly altered across an entire test set. Like Projected Gradient Descent, the attack optimizes a min-max problem, maximizing a goal function such as misclassification while minimizing the perturbations applied to the data. For each input, the algorithm computes the gradient of the model’s loss with respect to the input at the final layer, discards the gradient magnitudes, and retains only the sign to generate a set of candidate perturbations for each feature.

The statistical machinery behind the constraints is precise. Changes in marginal distributions are quantified with the Jensen-Shannon Distance, a symmetrized measure built from the Kullback-Leibler divergence between normalized histogram-based probability distributions. Changes in correlations are quantified with the relative Frobenius norm difference between the Pearson correlation matrices of clean and perturbed inputs. The team also introduces a complementary diagnostic, the maximum pairwise correlation change, because the Frobenius norm becomes insensitive to large changes concentrated in a single feature pair as feature dimensionality grows. For each candidate perturbation, the algorithm selects the modification that minimizes a combined loss weighted between the two constraints, repeating the selection over a fixed number of iterations, and can skip updates entirely whenever no candidate satisfies user-defined upper bounds on the per-step statistical change.

To build intuition, the researchers first demonstrated the attack on a deliberately simple two-dimensional toy dataset called Donut, in which a circular signal distribution sits at the center of a donut-shaped background. A baseline classifier achieves near-perfect separation, yet the attack shifts a large fraction of background events into the central signal region while preserving the qualitative structure of the original background marginals. The attack achieved an initial fooling ratio of 0.354 on this toy problem, which the team attributes to the low dimensionality: with only two features, perturbations cannot be distributed across a higher-dimensional space, making statistically consistent misclassification substantially harder. The simplicity that restricts performance is precisely what makes the mechanism directly visualizable.

The real tests came on two standard particle physics tasks. The first, based on the popular Higgs Boson Machine Learning Kaggle Challenge, uses 30 continuous input features and a multi-layer perceptron with roughly 42,000 trainable parameters. The second is a jet-tagging problem distinguishing jets from pairs of top quarks from those from pairs of W bosons, using simulated samples from the 2012 CMS run obtained through the CERN Open Data portal, with 87 input features and a TopoDNN-inspired architecture. Across ten independent runs on the Higgs task, the attack achieved an average fooling ratio of 0.89, meaning nearly nine out of ten events had their predicted label changed, while the average Jensen-Shannon Distance stayed below 0.02 and the relative Frobenius norm difference remained below 0.2. On the jet-tagging task, the average fooling ratio was 0.675 with similarly small statistical distortions, and the maximum pairwise correlation change stayed below 0.50 across all runs.

Remarkably, the same machinery that exposes vulnerabilities can also strengthen models. In low-data regimes, where the Higgs training set was reduced from roughly 150,000 to 5,000 events and the jet-tagging set from about 280,000 to 70,000, augmenting training data with adversarially perturbed events improved performance on clean test inputs by roughly one percentage point in AUROC, outperforming established tabular generative methods CTGAN and TVAE in the severely data-limited Higgs setting. The team interprets this as evidence that perturbing existing real samples provides a more reliable source of augmentation than learning to synthesize new ones when training statistics are scarce. The researchers also deployed two defenses: cumulative adversarial training, which reduced the average-case fooling ratio on the Higgs task from about 0.70 to roughly 0.2, and an adversarial detector network trained to distinguish clean from perturbed events, which pushed the corrected fooling ratio down to between 0.05 and 0.08.

The adversarial detector proved to be more than a defensive filter. When trained on simulated events and applied to real collision data from the 2012 CMS Single Mu dataset that it had never seen, the detector maintained a clean-event efficiency of around 0.8 even at high decision thresholds, performing almost identically on real and simulated events. This suggests there is no substantial domain gap that causes real events to be misidentified as adversaries, and consequently that the well-known degradation of model performance on real data likely cannot be explained solely by real events acting adversarially. The team also found little evidence that clean simulated events exhibit persistent adversarial structure. In a further extension, replacing the Pearson correlation constraint with distance correlation, which detects any form of dependence between variables, linear or non-linear, made the attack substantially harder but left the detector’s performance largely unaffected, indicating that the vulnerability reflects a broader weakness of the models rather than an exploitation of non-linear correlations alone.

The researchers propose a practical workflow for the field. A baseline model is trained on clean simulated events, adversarial examples are generated with the attack, and an adversarial detector is trained to quantify how much of the model’s susceptibility can be mitigated. If the corrected fooling ratio lies within the systematic uncertainty bounds derived from physical sources, and the fraction of adversarial samples detected in data is consistent with that observed in simulation, no additional uncertainty needs to be assigned. If not, physicists should hunt for unaccounted sources of discrepancy, and if none are found, additional uncertainties should be considered. The team argues that robustness to adversarial effects must become part of how deep learning results in particle physics are interpreted, and that systematic exploration of adversarial directions in feature space could eventually serve as a diagnostic instrument for both machine learning models and the event generators that underpin them. The accompanying code and data are openly available, inviting the community to stress-test its own models before nature, or an unknown flaw in simulation, does it first.

Subject of Research: Computing, Software and Data Science in High Energy Physics

Article Title: Shapes are not enough: CONSERVAttack and its use for finding vulnerabilities and uncertainties in machine learning applications

Article References: Bechtle, P., Flek, L., Jung, P. A., Karimi, A., Saala, T., Schmidt, A., Schott, M., Soldin, P., Wiebusch, C., & Willemsen, U. (2026). Shapes are not enough: CONSERVAttack and its use for finding vulnerabilities and uncertainties in machine learning applications. The European Physical Journal C, 86(10), Article 1172. https://doi.org/10.1140/epjc/s10052-026-16351-2

Image Credits: AI Generated

DOI: 10.1140/epjc/s10052-026-16351-2

Keywords: adversarial attack, machine learning, high energy physics, deep learning, systematic uncertainties, particle physics, CONSERVAttack, neural networks, data validation, jet tagging, Higgs boson, CMS Open Data